G1058: The Gentlemen
The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.[1][2][3][4][5][6][7][8]
Security context for executives and security teams
G1058: The Gentlemen describes [The Gentlemen](https://attack.mitre.org/groups/G1058) is a group that maintains the [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051)-as-a-service (RaaS). [The Gentlemen](https://attack.mitre.org/groups/G1058) was first observed in mid-2025 who had posed [The Gentlemen Ransomware](https://attack.mitre.org/software/S9051) as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. [The Gentlemen](https://attack.mitre.org/groups/G1058) has been affiliat...
Executive priority
G1058: The Gentlemen is an official MITRE ATT&CK group. Glexia treats it as defensive behavior context for prioritizing monitoring, control validation, and response planning without using the object by itself as an attribution claim.
Technical view
Security teams should validate G1058: The Gentlemen by reviewing the official ATT&CK relationships, mapped tactics (the mapped ATT&CK tactic context), supported platforms (the platforms named in the official object), and available local telemetry before making detection or mitigation decisions.
Likely telemetry
- Official ATT&CK relationships and object metadata
Detection direction
- Validate whether G1058: The Gentlemen appears in your detection coverage and tabletop scenarios.
- Use the object to align executive risk language with SOC, incident response, and detection engineering work.
- Do not treat ATT&CK relationship context as attribution without corroborating evidence.
Mitigation priorities
- Map the object to existing controls and identify missing telemetry or response ownership.
- Prioritize mitigations that reduce exposure on the listed platforms and tactics.
- Review adjacent ATT&CK relationships before changing policy, detections, or reporting language.
Additional notes and limits
Baseline Glexia take generated from the official MITRE ATT&CK STIX object, source hash, tactics, platforms, and detection fields. It is safe to replace with a richer model-generated take for the same source hash later.
This baseline take is source-grounded and schema-validated, but it does not include environment-specific telemetry, incident evidence, or threat-intelligence corroboration.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
The Gentlemen
The Gentlemen is a group that maintains the The Gentlemen Ransomware-as-a-service (RaaS). The Gentlemen was first observed in mid-2025 who had posed The Gentlemen Ransomware as a closed ransomware and shortly later opened the ransomware as a RaaS to affiliates in September 2025. The Gentlemen has been affiliated with the threat group Storm-2697 and GOLD SHERWOOD.[1][2][3][4][5][6][7][8]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1027.002 | Software PackingSub-technique | The Gentlemen has packed The Gentlemen Ransomware binaries utilizing either Themida or Enigma to obfuscate the malicious payloads.[4] |
| Enterprise | T1068 | Exploitation for Privilege Escalation | The Gentlemen has assisted affiliates with gaining privilege escalation through the use of BYOVD.[6] |
| Enterprise | T1583.001 | DomainsSub-technique | The Gentlemen has maintained a TOR Data Leak Site (DLS) to post stolen victim data.[3][4][5][8] |
| Enterprise | T1486 | Data Encrypted for Impact | The Gentlemen has used The Gentlemen Ransomware to encrypt victim’s data.[3][4][7][8] |
| Enterprise | T1585.001 | Social Media AccountsSub-technique | The Gentlemen has established social media accounts on X.[3][5] |
| Enterprise | T1683.001 | Written ContentSub-technique | |
| Enterprise | T1036 | Masquerading | The Gentlemen has fabricated the version information of payload files to evade detection.[4] |
| Enterprise | T1036.005 | Match Legitimate Resource Name or LocationSub-technique | The Gentlemen has named The Gentlemen Ransomware payload files to resemble well-known software vendors to include security vendors. The Gentlemen has also utilized icons that match impersonated vendors.[4] |
| Enterprise | T1036.001 | Invalid Code SignatureSub-technique | The Gentlemen has copied digital signatures from legitimate executables in attempts to circumvent detection.[4] |
| Enterprise | T1190 | Exploit Public-Facing Application | The Gentlemen has exploited vulnerable public-facing devices and services to gain access to victim environments.[2][4][6][8] |
| Enterprise | T1657 | Financial Theft | |
| Enterprise | T1683.002 | Audio-Visual ContentSub-technique | The Gentlemen has leveraged a branded graphic that is placed on the systems desktop wallpaper that symbolizes the association of malicious activity to the group.[1][5][6] |
| Enterprise | T1219.002 | Remote Desktop SoftwareSub-technique | The Gentlemen has relied on remote access tools, such as AnyDesk, as a means of maintaining access to victim environment.[8] |
| Enterprise | T1585 | Establish Accounts | The Gentlemen and its affiliates have leveraged Tox to communicate with victims.[7][8] |
| Enterprise | T1588.002 | ToolSub-technique | The Gentlemen has provided a custom EDR killing tool called GentleKiller and other like software that abuse vulnerable drivers via the Bring Your Own Vulnerable Driver (BYOVD) technique to their affiliates that attempts to disable EDR solutions.[2][3][4][6][8] The Gentlemen has obtained tools to include Advanced IP Scanner, the PowerRun utility and Rocket Chat communication tools.[2][3][6][8] |
| Enterprise | T1018 | Remote System Discovery | The Gentlemen has utilized internal network scanning tools to enumerate additional hosts in the victim environment to include Advanced IP Scanner.[2] |
| Enterprise | T1078 | Valid Accounts | The Gentlemen has leveraged compromised user credentials to gain access to victim hosts.[2][6][7] |
Groups, software, and campaigns
S0645: Wevtutil
S9051: The Gentlemen Ransomware
The Gentlemen Ransomware is a ransomware-as-a-service (RaaS). The Gentlemen Ransomware has been written in Go programming language and has utilized Garble to obfuscate its code to target Windows environments. The Gentlemen Ransomware is capable of executing its’ OS lockers in Windows, Linux, NAS, BSD and ESXi environments. The Gentlemen Ransomware was first observed in mid-2025 as a closed ransomware and shortly later emerged as a RaaS to affiliates in September 2025. The Gentlemen Ransomware has been affiliated with the threat group The Gentlemen.[1][2][3][4]
S0029: PsExec
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 20.0 | 1.0 | Current bundle | 271b14829052… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]MSTI_GentelmenRansomware_May2026
Microsoft Threat Intelligence. (2026, May 28). The Gentlemen ransomware: Dissecting a self-propagating Go encryptor . Retrieved September 18, 2026.
Open source URL - [2]Intel471_TheGentlemen_Aug2026
Intel 471. (2026, August 11). Threat Hunting Case Study: The Gentlemen. Retrieved September 18, 2026.
Open source URL - [3]Sophos_TheGentlemen_Sept2026
Sophos Counter Threat Unit Research Team. (2026, September 1). Ungentlemanly behavior: Insights into a ransomware operation. Retrieved September 18, 2026.
Open source URL - [4]SoučekESET_Gentlemen_Jun2026
Souček, J. (2026, June 18). Killing me gently: Inside Gentlemen’s EDR killer framework. Retrieved September 18, 2026.
Open source URL - [5]CheckPointResearch_TheGentlemen_April2026
Check Point Research. (2026, April 20). DFIR Report – The Gentlemen & SystemBC: A Sneak Peek Behind the Proxy. Retrieved September 18, 2026.
Open source URL - [6]BradyUnit42_TheGentlemen_July2026
Brady, M. (2026, July 10). No Manners Here: The Ruthless Rise of The Gentlemen Ransomware. Retrieved September 18, 2026.
Open source URL - [7]CarveyODonnellWelchHuntress_TheGentlemen_May2026
Carvey, H., O'Donnell-Welch, L. (2026, May 21). The Gentlemen (Ransomware) in Disguise: Defense Evasion and other TTPs. Retrieved September 18, 2026.
Open source URL - [8]TrendAI_TheGentlemen_Sept2025
Santos, J., et al. (2025, September 9). Unmasking The Gentlemen Ransomware: Tactics, Techniques, and Procedures Revealed . Retrieved September 18, 2026.
Open source URL - [9]GOLD SHERWOOD
(Citation: Sophos_TheGentlemen_Sept2026)
- [10]Storm-2697
(Citation: MSTI_GentelmenRansomware_May2026)
- [11]mitre-attackG1058Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.